# Enumerating Vector Databases and RAG Pipeline Components

> Techniques for discovering and mapping vector database instances, embedding endpoints, and RAG pipeline components to identify attack surface in AI-driven applications.

- **URL:** https://hackindex.io/platforms/ai/reconnaissance/enumerating-vector-databases-and-rag-components
- **Path:** AI Platforms > Reconnaissance
- **Up:** [Reconnaissance](https://hackindex.io/platforms/ai/reconnaissance.md)
- **Published:** 2026-03-18
- **Updated:** 2026-08-11

RAG pipelines depend on a vector database to store and retrieve document embeddings. These databases are a distinct attack surface from the LLM itself: they contain the knowledge the model draws from, and compromising them means controlling what the model believes is true. Before attacking the RAG pipeline, you need to identify which vector database is in use, whether it is directly accessible, what collections or indices exist, and what data they contain.

Components to enumerate in a typical RAG pipeline:

- Vector database (Chroma, Qdrant, Weaviate, Milvus, Pinecone)
- Embedding service used for query and document vectorization
- Document storage backend (S3, local filesystem, network shares)
- Ingestion pipeline that processes documents into chunks and embeddings
- Retrieval API that queries the vector store and feeds context to the LLM

## Enumerate Vector Database and RAG Pipeline from Application Responses

RAG applications sometimes leak vector database metadata in their responses, particularly when debug logging is enabled or source citations are included:

```bash
curl -sk -X POST https://$TARGET_DOMAIN/api/chat -H 'Content-Type: application/json' -d '{"messages":[{"role":"user","content":"What sources did you use to answer that?"}]}' | python3 -m json.tool
# {
#     "response": "Based on the following sources...",
#     "source_documents": [
#         {"metadata": {"source": "s3://company-docs/policy.pdf", "chunk_id": "abc123"}}
#     ]
# }
```

Source metadata in responses reveals the document storage backend, chunk identifiers, and sometimes internal file paths. S3 bucket names, internal network paths, and document identifiers found here are useful for supply chain and data poisoning attacks in later phases.

## Probe for Exposed Chroma

Chroma runs on port 8000 by default with no authentication in development mode. Check the heartbeat and list collections:

```bash
curl -sk http://$TARGET_IP:8000/api/v2/heartbeat
# {"nanosecond heartbeat": 1234567890}
```

```bash
curl -sk http://$TARGET_IP:8000/api/v2/collections | python3 -m json.tool
# [
#     {
#         "name": "company_knowledge_base",
#         "id": "a1b2c3d4-...",
#         "metadata": {"description": "Internal policy documents"}
#     }
# ]
```

An exposed Chroma instance reveals collection names, metadata, and collection IDs. With the collection ID you can query and retrieve embeddings and documents directly: covered in the RAG exploitation phase.

## Probe for Exposed Qdrant

Qdrant runs on port 6333 with a REST API and no authentication by default:

```bash
curl -sk http://$TARGET_IP:6333/collections | python3 -m json.tool
# {
#     "result": {
#         "collections": [
#             {"name": "product_documentation"},
#             {"name": "support_tickets"}
#         ]
#     },
#     "status": "ok"
# }
```

```bash
curl -sk http://$TARGET_IP:6333/collections/product_documentation | python3 -m json.tool
```

## Probe for Exposed Weaviate

Weaviate runs on port 8080 with a GraphQL and REST API:

```bash
curl -sk http://$TARGET_IP:8080/v1/schema | python3 -m json.tool
# {
#     "classes": [
#         {
#             "class": "Document",
#             "description": "Company documents",
#             "properties": [
#                 {"name": "content", "dataType": ["text"]},
#                 {"name": "source", "dataType": ["text"]}
#             ]
#         }
#     ]
# }
```

The Weaviate schema reveals the data structure of every class stored in the database including property names and data types. Property names like `source`, `author`, `classification`, or `internal` indicate the type and sensitivity of stored documents.

## Identify Embedding Service Endpoints

RAG pipelines use a separate embedding service to convert query text into vectors. These are sometimes exposed independently from the vector database:

```bash
curl -sk -X POST https://$TARGET_DOMAIN/api/v2/embeddings -H 'Content-Type: application/json' -d '{"input":"test","model":"text-embedding-3-small"}' | python3 -m json.tool
# {
#     "object": "list",
#     "data": [
#         {
#             "object": "embedding",
#             "embedding": [0.0023, -0.0141, ...],
#             "index": 0
#         }
#     ],
#     "model": "text-embedding-3-small"
# }
```

An accessible embedding endpoint can be used to generate embeddings for attacker-controlled content during RAG poisoning attacks: covered in the exploitation phase. The model name in the response confirms which embedding model is used, which is necessary for crafting effective poisoning payloads.

## References

- [Chroma: API reference](https://docs.trychroma.com/reference/py-client) - Chroma REST API endpoints including collections and heartbeat
- [Qdrant: API interfaces documentation](https://qdrant.tech/documentation/interfaces/) - Qdrant REST API reference including collections endpoint
- [Weaviate: REST API reference](https://weaviate.io/developers/weaviate/api/rest) - Weaviate schema and data endpoints